Wednesday, October 08, 2008 8:45 AM
cmosby
Adobe Flash Player "Clickjacking" Security Bypass Vulnerability - Secunia
Adobe Flash Player "Clickjacking" Security Bypass Vulnerability
Secunia Advisory:
SA32163
Release Date:
2008-10-08
Popularity:
510 views
Critical:
Less critical
Impact:
Security Bypass
Exposure of sensitive information
Where:
From remote
Solution Status:
Vendor Workaround
Software:
Adobe Flash Player 9.x
Subscribe:
Instant alerts on relevant vulnerabilities 
Description:
A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to bypass certain security restrictions and disclose potentially sensitive information.
The vulnerability is caused due to a design error and can be exploited to e.g. gain access to the system's camera and microphone by tricking the user into clicking Flash Player access control dialogs disguised as normal graphical elements.
The vulnerability is reported in version 9.0.124.0. Other versions may also be affected.
Solution:
The vendor recommends disabling Flash Player camera and microphone interactions. Please see the vendor's advisory for more information.
Provided and/or discovered by:
The vendor credits Robert Hansen of SecTheory, Jeremiah Grossman of WhiteHat Security, Eduardo Vela, Matthew Mastracci of DotSpots, and Liu Die Yu.
Original Advisory:
http://www.adobe.com/support/security/advisories/apsa08-08.html
http://blogs.adobe.com/psirt/2008/10/clickjacking_security_advisory.html
Filed under: Security and Anti-Virus, Patch Management, Internet Applications, Software Vulnerabilites